k8s:cluster
Kubernetes cluster
API server audit and orchestrator events.
- Host type
- Kubernetes
- Standards scope
- cloud
- Minimum events
- 0
- Recommended events
- 6
- Log sources
- 3
Logs, as a whole
For this role the log is the unit an organization turns on, so each log is tiered as a whole, beside the per-event rows.
| Log | Tier | Techniques | Rules |
|---|---|---|---|
| Kubernetes API server audit log | Minimum | 18 | 122 |
| Kubernetes events / orchestrator logs | Recommended | 4 | 0 |
Minimum
No event reaches the minimum bar for this role at the event level. The logs tiered as a whole, above, are the unit to read.
Recommended
6 more events meet one of the three criteria. Each source opens on its own.
Kubernetes API server audit log6 events · Included
| Event | How to enable | Techniques | Rules | Standards |
|---|---|---|---|---|
| authentication.k8s.io | 1 | none | ||
| authentication.k8s.io/v1beta1 | 1 | none | ||
| create | 1 | Elastic 1 | ||
| exec | 0 | Elastic 3 | ||
| get | 0 | Elastic 8 | ||
| list | 0 | Elastic 6 |